GHSA-P3JP-9V83-76W9: CVE-2026-111497 / GHSA-p3jp-9v83-76w9: Out-of-Bounds Heap Write in Microsoft .NET Brotli Decoder
CVE-2026-111497 / GHSA-p3jp-9v83-76w9: Out-of-Bounds Heap Write in Microsoft .NET Brotli Decoder Vulnerability ID: GHSA-P3JP-9V83-76W9 CVSS Score: 8.1 Published: 2026-11-03 CVE-2026-111497 (tracked as GHSA-p3jp-9v83-76w9) is an out-of-bounds heap write vulnerability in the native Google Brotli decompression library bundled within the Microsoft .NET runtime. The flaw occurs during the parsing of…
CVE-2026-111497, also identified as GHSA-p3jp-9v83-76w9, represents an out-of-bounds heap write vulnerability in the Microsoft .NET Brotli decoder. This flaw allows unauthenticated attackers to corrupt memory via specially crafted Brotli compressed data, leading to denial of service, information disclosure, or potentially arbitrary code execution.
The vulnerability stems from the fast execution path of the .NET runtime's Brotli decoder, which skips validation of block-switch sequences, leaving the process open to memory corruption. Patched versions of the .NET runtime address this issue, including .NET 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3. Applications utilizing the Brotli decompression feature must be updated to these versions to mitigate the risk.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
